# Dmarc2logstash fails to log in to outlook365 mail account

**URL:** <https://discuss.elastic.co/t/dmarc2logstash-fails-to-log-in-to-outlook365-mail-account/187990>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 28, 2019, 8:27am UTC](https://discuss.elastic.co/t/dmarc2logstash-fails-to-log-in-to-outlook365-mail-account/187990 "2019-06-28T08:27:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [June 28, 2019, 8:27am UTC](https://discuss.elastic.co/t/dmarc2logstash-fails-to-log-in-to-outlook365-mail-account/187990/1 "2019-06-28T08:27:04Z")

</div>

I've had this running nicely, the dmarc2logstash runs, and pulls all the reports, unzips, and places them ready for filebeat to grab, and send to logstash.  
I've used the code from jertel: [https://github.com/jertel/dmarc2logstash](https://github.com/jertel/dmarc2logstash)

But now I get this shown in the log:

```
dmarc | 2019-06-28 08:14:04,471 - dmarc2logstash - INFO - Starting DMARC to Logstash service; sleepSec=300; jsonOutputFile=/dmarclogs/dmarc.log; shouldDelete=1
dmarc | 2019-06-28 08:14:04,471 - dmarc2logstash - INFO - Connecting to POP3 server; server=outlook.office365.com; username=dmarc@onemarketing.dk; debugLevel=0
dmarc | Traceback (most recent call last):
dmarc | File "/opt/dmarc2logstash/dmarc2logstash.py", line 203, in <module>
dmarc | sys.exit(main())
dmarc | File "/opt/dmarc2logstash/dmarc2logstash.py", line 200, in main
dmarc | start(server, username, password, int(sleepSec), jsonOutputFile, float(timeout), int(shouldDelete))
dmarc | File "/opt/dmarc2logstash/dmarc2logstash.py", line 163, in start
dmarc | download(server, username, password, jsonOutputFile, timeout, shouldDelete)
dmarc | File "/opt/dmarc2logstash/dmarc2logstash.py", line 41, in download
dmarc | conn = connect(server, username, password, timeout)
dmarc | File "/opt/dmarc2logstash/dmarc2logstash.py", line 35, in connect
dmarc | conn.pass_(password)
dmarc | File "/usr/lib/python2.7/poplib.py", line 197, in pass_
dmarc | return self._shortcmd('PASS %s' % pswd)
dmarc | File "/usr/lib/python2.7/poplib.py", line 160, in _shortcmd
dmarc | return self._getresp()
dmarc | File "/usr/lib/python2.7/poplib.py", line 136, in _getresp
dmarc | raise error_proto(resp)
dmarc | poplib.error_proto: -ERR Logon failure: unknown user name or bad password.

```

I've tested a login with a client using the name and password from the docker-compose config, and that works perfectly.  
It was working a few months back, and I haven't checked up on it in while, but now I just see this message.

The config in docker-compose looks like this:

```
  dmarc:
    image: jertel/dmarc2logstash
    container_name: dmarc
    volumes:
      - ./dmarc/logs:/logs
      - ./dmarc/dmarc2logstash.json:/opt/dmarc2logstash/dmarc2logstash.json
      - ./dmarc/dmarclogs:/dmarclogs
    environment:
      - POP3_SERVER=outlook.office365.com
      - POP3_USERNAME=uh-oh-secret-hu
      - POP3_PASSWORD=uh-oh-even-more-secret
      - DELETE_MESSAGES=1
      - JSON_OUTPUT_FILE=/dmarclogs/dmarc.log
    restart: always

  dmarcfilebeat:
    image: docker.elastic.co/beats/filebeat:6.5.1
    container_name: dmarcfilebeat
    volumes:
      - ./dmarc/dmarclogs:/dmarclogs
      - ./dmarc/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./dmarc/logs:/logs

```

Anybody that has an idea, Jertel maybe? 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2019, 8:27am UTC](https://discuss.elastic.co/t/dmarc2logstash-fails-to-log-in-to-outlook365-mail-account/187990/2 "2019-07-26T08:27:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.